Brad and Elan,
Thanks for the helpful thought. I checked AutodiscoverServiceInternalURI and all the URLs and found them correctly set to use i.e. "mail.contoso.com". Then, I realized there was no DNS entry for it yet. After I added a host record for i.e. "mail.contoso.com", Outlook clients stops showing that security alerts. I tried with restarting Outlook client, send/receive, download OAB, check availability, etc. All seem work well now.
One more question for you guys. If I have multiple sites, and use the same certificate for CAS servers at different sites, I will need to add one DNS entry i.e. "mail.contoso.com" for each of CAS servers, right? If I do this, will the DNS round robin cause problem when clients accessing the CAS services? What I don't want to see happen is clients in one site are pointed to CAS servers in other remote sites, or it causes lots of proxying between the CAS servers. Is there a built-in mechanism that will limit the internal clients to access their local CAS servers in this case? I'd like to hear your thoughts on this.
Thanks,
Adam